METHODOLOGICAL AND PROCEDURAL ASPECTS OF DAMAGE ASSESSMENT FROM CYBERATTACKS

Abstract

Cyberattacks pose unprecedented challenges for legal systems in assessing and compensating damage. Unlike traditional harms, cyber incidents often cause diffuse and intangible losses—ranging from stolen data and business interruption to reputational and emotional harm—that are difficult to quantify. This thesis explores the methodological hurdles in measuring such harm and the procedural barriers to proving it in court. It examines how conventional valuation models struggle with cyber losses (for example, putting a price on confidential data or lost consumer trust) and how courts increasingly rely on expert evidence and novel proxies to estimate damage. The discussion also analyzes procedural issues, including the burden of proof on victims to establish causation and loss, the complexities of handling digital evidence, and the need for expert testimony to bridge technical gaps. Comparative examples from international practice illustrate a spectrum of approaches: some jurisdictions have begun to recognize claims for purely non-material harm or to ease evidentiary burdens on cyber victims, while others remain cautious, demanding concrete proof of loss. The overall analysis underscores that damage assessment in cyberattack cases remains an evolving frontier where legal principles are being tested and refined to accommodate the realities of the digital age.